SRV-070 취약한 패스워드 저장 방식 사용

SRV-070 취약한 패스워드 저장 방식 사용

【 상세설명 】
취약한 패스워드 저장 방식을 사용할 경우, 공격자에게 계정의 로그인 정보가 탈취되어 악용될 위협이 존재하므로 관련 설정의 적절성 여부를 점검

【 판단기준 】
- 양호 : shadow 패스워드를 사용하거나, 패스워드를 안전한 강도로 암호화하여 저장하는 경우
- 취약 : shadow 패스워드를 사용하지 않고, 패스워드를 안전하지 않은 강도로 암호화하여 저장하지 않는 경우

【 판단방법 】
  ■ Linux
      1. "/etc/passwd" 의 두 번째 필드가 "x"로 표시되어 있는지 확인
          ※ 두 번째 필드가 "x"가 아닌 경우 shadow 패스워드(pwconv 모드)를 사용하지 않는 경우로 "취약"
      2. "/etc/shadow" 의 두 번째 필드(encrypted_password 필드)의 암호 알고리즘 id 확인
          ※ encrypted_password 필드의 암호 알고리즘 id 가 없거나 보안강도 112비트 이상 제공하는 해시함수($5$, $6$, $y$ (or $7$), … )를 사용하지 않는 경우 "취약"
      3. "/etc/login.defs" 파일의 ENCRYPT_METHOD 설정 확인
          ※ "ENCRYPT_METHOD" 설정이 없거나 "DES", "MD5", "BCRYPT 인 경우 "취약"

      (pwconv 모드인 경우)
      # cat /etc/passwd
          root:x:0:0:root:/root:/bin/bash
          daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
          …

      # cat /etc/shadow
          root:$y$j9T$PqNkG1SAHFMlQYrjGb29i.$amT3vaKG1Zh0skuqZr66sVLzvTdirO92VPA5R77/.JC:19696:0:99999:7:::
          daemon:*:19682:0:99999:7:::
          …

      # cat /etc/login.defs | grep ENCRYPT_METHOD
          ENCRYPT_METHOD SHA512

      (pwunconv 모드인 경우)
      # cat /etc/passwd
          root:$y$j9T$PqNkG1SAHFMlQYrjGb29i.$amT3vaKG1Zh0skuqZr66sVLzvTdirO92VPA5R77/.JC:0:0:root:/root:/bin/bash
          daemon:*:1:1:daemon:/usr/sbin:/usr/sbin/nologin
          ...

      # cat /etc/shadow
          cat: /etc/shadow: No such file or directory

      # cat /etc/login.defs | grep ENCRYPT_METHOD
          ENCRYPT_METHOD SHA512

      ※ Linux encrypted_password 필드
          - encrypted_password 구성 : $id$salt$hashed
          - encrypted_password 암호 알고리즘 id
            (none) : DES
            $1$ : MD5(Message Digest 5)
            $2a$, $2b$, $2y$, … : BCRYPT
            $5$ : SHA-256(256-bit Secure Hash Algorithm)
            $6$ : SHA-512(512-bit Secure Hash Algorithm)
            $y$ (or $7$) : YESCRYPT

  ■ AIX
      1. "/etc/security/passwd" 파일에 비밀번호가 암호화되어 있는지 확인
          ※ AIX 는 기본적으로 "/etc/security/passwd" 파일에 패스워드를 암호화하여 저장ㆍ관리
          ※ "password" 필드의 암호 알고리즘 설정이 없거나 보안강도 112비트 이상 제공하는 해시함수({ssha256}, {ssha512}, … )를 사용하지 않는 경우 "취약"
      2. "/etc/security/login.cfg" 의 usw 절 "pwd_algorithm" 설정 확인
          ※ "pwd_algorithm" 의 암호 알고리즘 설정이 없거나 보안강도 112비트 이상 제공하는 해시함수(ssha256, ssha512, … )를 사용하지 않는 경우 "취약"

      # cat /etc/passwd
          root:!:0:0::/:/opt/freeware/bin/bash
          daemon:!:1:1::/etc:
          ...

      # cat /etc/security/passwd
          root:
              password = {ssha512}06$e/0llMw8/K4wsJXP$sIbiR220kAvHmQfTj0s04LgZcWwK0UOWuyaSSKJSuBTGKh8oLwX2GbeC7vvkCiHE/pVmqI4zJwD6n2fllq8L.
              lastupdate = 1026394230

          daemon:
              password = *
          ...

      # cat /etc/security/login.cfg
          usw:
                  shells = /bin/sh,/bin/bsh,/bin/csh,/bin/ksh,/bin/tsh,/bin/ksh93         
                  maxlogins = 32767         
                  logintimeout = 60         
                  maxroles = 8         
                  auth_type = STD_AUTH
                  pwd_algorithm=ssha512

  ■ HP-UX
      1. Trusted Mode 폴더 및 TCB 파일 존재 유무 확인
          ※ 계정별 TCB 파일 : /tcb/files/auth/<account_initial>/<account_ name>
              ("account_initial" 은 "account_name" 의 첫 번째 알파벳)
      2. "/etc/passwd" 의 두 번째 필드에 암호화된 패스워드 대신 "x"(pwconv Mode) 또는 "*"(Trusted Mode) 로 표시되어 있는지 확인
          ※ 두 번째 필드가 "x" 또는 "*" 아닌 경우 shadow 패스워드 또는 Trusted Mode 를 사용하지 않는 경우로 "취약"
      3. "/etc/shadow" 의 두 번째 필드(encrypted_password 필드)의 암호 알고리즘 id 확인
          ※ encrypted_password 필드의 암호 알고리즘 id 가 없거나 보안강도 112비트 이상 제공하는 해시함수($6$)를 사용하지 않는 경우 "취약"
      4. "/etc/default/security" 파일에서 "CRYPT_DEFAULT" 설정 확인
          ※  "CRYPT_DEFAULT" 설정이 없거나 보안강도 112비트 이상 제공하는 해시함수(6)를 사용하지 않는 경우 "취약"

      # /tcb/files/auth/*/*
          -rw-rw-r--   1 root       sys            399 Sep  3  2003 /tcb/files/auth/system/default
          …

      (pwconv 모드인 경우)
      # cat /etc/passwd
          root:x:0:3::/:/sbin/sh
          daemon:x:1:5::/:/sbin/sh
          bin:x:2:2::/usr/bin:/sbin/sh

      # cat /etc/shadow
          root:2aXLkAtszrhfM:19722::::::
          daemon:*:19722::::::
          …

      # cat /etc/default/security | grep CRYPT_DEFAULT
          CRYPT_DEFAULT=6

      (pwunconv 모드인 경우)
      # cat /etc/passwd
          root:2aXLkAtszrhfM:19722::::::
          daemon:*:19722::::::
          …

      # cat /etc/shadow
          cat: Cannot open /etc/shadow: No such file or directory

      # cat /etc/default/security | grep CRYPT_DEFAULT
          CRYPT_DEFAULT=6

  ■ SOLARIS
      1. "/etc/passwd" 의 두 번째 필드가 "x"로 표시되어 있는지 확인
          ※ 두 번째 필드가 "x"가 아닌 경우 shadow 패스워드(pwconv 모드)를 사용하지 않는 경우로 "취약"
      2. "/etc/shadow" 의 두 번째 필드(encrypted_password 필드)의 암호 알고리즘 id 확인
          ※ encrypted_password 필드의 암호 알고리즘 id 가 없거나 보안강도 112비트 이상 제공하는 해시함수($5$, $6$, … )를 사용하지 않는 경우 "취약"
      3. "/etc/security/policy.conf" 파일의 "CRYPT_DEFAULT" 설정 확인
          ※  "CRYPT_DEFAULT" 설정이 없거나 보안강도 112비트 이상 제공하는 해시함수(5, 6)를 사용하지 않는 경우 "취약"

      (pwconv 모드인 경우)
      # cat /etc/passwd
          root:x:0:0:Super-User:/root:/usr/bin/bash
          daemon:x:1:1::/:
          …

      # cat /etc/shadow
          root:$5$cgQk2iUy$AhHtVGx5Qd0.W3NCKjikb8.KhOiA4DpxsW55sP0UnYD:18760::::::21712128
          daemon:NP:6445::::::
          …

      # /etc/security/policy.conf | grep CRYPT_DEFAULT
          CRYPT_DEFAULT=5

      (pwunconv 모드인 경우)
      # cat /etc/passwd
          root:$5$cgQk2iUy$AhHtVGx5Qd0.W3NCKjikb8.KhOiA4DpxsW55sP0UnYD:0:0:Super-User:/root:/bin/bash
          daemon:NP:1:1::/:
          ...

      # cat /etc/shadow
          cat: cannot open /etc/shadow: No such file or directory

      # cat /etc/security/policy.conf | grep CRYPT_DEFAULT
          CRYPT_DEFAULT=5

      ※ SOLARIS encrypted_password 필드
          - encrypted_password 구성 : $id$salt$hashed
          - encrypted_password 암호 알고리즘 id
            (none) : DES
            $1$ = BSD MD5(Message Digest 5)
            $2a$ = BSD Blowfish (Bcrypt)
            $md5$ = SUN’s MD5
            $5$ : SHA-256(256-bit Secure Hash Algorithm)
            $6$ : SHA-512(512-bit Secure Hash Algorithm)

【 조치방법 】
  ■ Linux
      1. shadow 패스워드 정책 사용 설정
      2. "/etc/login.defs" 파일에서 보안강도 112비트 이상 제공하는 해시함수 사용 설정
          ※ "ENCRYPT_METHOD" 을 "SHA256", "SHA512", "YESCRYPT" 등으로 설정
          ※ "ENCRYPT_METHOD" 옵션 : DES, MD5, BCRYPT, SHA256, SHA512, YESCRYPT
      3. 보안강도 112비트 이상 제공하는 해시함수를 사용하지 않는 계정 패스워드 재설정
          ※ "/etc/login.defs" 파일 정책은 신규 설정하는 경우에만 적용

2024-01-13 : (조치과정 삭제)